s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

journalctl

Read and search the systemd journal: by service, time, priority, boot, user and any field.

Niveau
RHCSA-examen
Groep
Logs
Root nodig
Voor wijzigingen
Pakket
systemd

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

journald stores messages of the kernel, the boot, services and programs with many fields (unit, PID, UID, priority …). journalctl shows them, oldest first, in a pager. Filters can be combined: journalctl -u sshd -p warning --since today.

Normal users see their own messages; members of wheel, adm and systemd-journal see all. The journal is persistent only if /var/log/journal exists (or Storage=persistent).

Zo schrijf je het

journalctl [OPTION]... [FIELD=VALUE]...

Opties 53

Meest gebruikt

Filter

-u, --unit=UNIT
Messages of a unit (pattern allowed).
--user-unit=UNIT
Messages of a user unit.
-p, --priority=PRIO
Priority or range: emerg, alert, crit, err, warning, notice, info, debug (or 0-7, err..warning).
-S, --since=TIME
From this time: today, yesterday, -1h, "2026-10-25 08:00".
-U, --until=TIME
Until this time.
-b, --boot[=ID|±N|all]
This boot, or another (-1 = the boot before).
-k, --dmesg
Only kernel messages (implies -b).
-t, --identifier=ID
Messages with this syslog tag.
-g, --grep=PATTERN
Messages that match a regular expression.
--case-sensitive[=BOOL]
Case for --grep.
--facility=FACILITY
Syslog facility.
FIELD=VALUE
Field filter, like _PID=1010, _UID=1001, _COMM=sudo, _SYSTEMD_UNIT=sshd.service.
-c, --cursor=CURSOR, --after-cursor=CURSOR, --cursor-file=FILE
Start at a saved position.

Output

-f, --follow
Show new messages live.
-n, --lines=N
The last N lines (default 10).
-r, --reverse
Newest first.
-e, --pager-end
Jump to the end in the pager.
-o, --output=MODE
Format: short, short-iso, short-precise, verbose, json, json-pretty, cat, export …
--output-fields=LIST
Fields to show with json/verbose.
-x, --catalog
Add explanations from the message catalog.
-a, --all
Show all fields, also long or unprintable ones.
-l, --full, --no-full
Do not cut / cut long lines.
--no-hostname
Hide the host name.
--utc
Times in UTC.
--truncate-newline
Only the first line of multi-line messages.
--show-cursor
Print the cursor at the end.
-q, --quiet
No info messages.
--no-pager
Do not use a pager.
--no-tail
With -f: show all lines first.

Sources

--system, --user
System or user journal.
-m, --merge
Merge all journals (also remote ones).
-D, --directory=DIR
Read the journal in this folder.
--file=GLOB
Read these journal files.
--root=ROOT, --image=IMAGE, --image-policy=POLICY
Read from another root or image.
--namespace=NAME
A journal namespace.
-M, --machine=NAME
A container's journal.

Fields and boots

-F, --field=FIELD
List all values of a field (like _SYSTEMD_UNIT).
-N, --fields
List all field names.
--list-boots
List the stored boots.

Maintenance

--disk-usage
Space used by the journal.
--vacuum-size=SIZE
Delete old files until the journal is under this size.
--vacuum-time=TIME
Delete entries older than this.
--vacuum-files=N
Keep only N files.
--rotate
Start new journal files.
--flush
Move the memory journal to /var/log/journal.
--sync
Write all pending messages to disk.
--relinquish-var, --smart-relinquish-var
Stop writing to /var (before unmounting it).
--verify
Check the journal files for damage.
--setup-keys, --verify-key=KEY, --interval=TIME, --force
Forward Secure Sealing (tamper proof logs).
--header
Show the file headers.
--list-catalog, --dump-catalog, --update-catalog
Message catalog tools.
-h, --help
Show help.
--version
Show the version.

Voorbeelden 15

$ als gewone gebruiker# als root (of met sudo)

  1. 1Messages of one service

    journalctl -u sshd

    Everything sshd logged.

  2. 2Errors since the boot

    journalctl -p err -b

    The first look after a problem.

  3. 3Follow a service live

    journalctl -fu httpd

    Leave it open while you test.

  4. 4A time window

    journalctl --since "2026-10-25 08:00" --until "2026-10-25 09:00"

    Also: --since -2h, --since yesterday.

  5. 5The boot before

    journalctl --list-boots
journalctl -b -1 -p warning

    Why did the server crash or reboot?

  6. 6Kernel messages

    journalctl -k -p warning

    Disk, memory and driver problems.

  7. 7All sudo commands today (audit)

    journalctl _COMM=sudo --since today

    User, folder and command of each sudo call.

  8. 8Failed SSH logins (security)

    journalctl -u sshd --since today -g 'Failed password|Invalid user'

    Many lines from one IP = a brute-force attack.

  9. 9Messages of one user

    journalctl _UID=1001 --since today

    What lisa's processes logged.

  10. 10All fields of one entry

    journalctl -u sshd -n 1 -o verbose

    Shows the fields you can filter on.

  11. 11JSON for tools

    journalctl -u myapp -o json --since -10min | jq -r '.MESSAGE'

    Feed a SIEM or script.

  12. 12Explain a failure

    journalctl -xeu httpd

    -x adds help text, -e jumps to the end.

  13. 13Disk use and cleanup

    journalctl --disk-usage
journalctl --vacuum-time=30d

    Removes entries older than 30 days.

  14. 14Which units logged at all?

    journalctl -F _SYSTEMD_UNIT | sort | head

    Lists every unit name in the journal.

  15. 15Check the journal for damage

    journalctl --verify

    PASS/FAIL per file.

Let op

  • Without a persistent journal, -b -1 shows nothing: older boots are gone.
  • Times in --since need quotes when they contain a space.

Bestanden

/run/log/journal/
Journal in memory (lost at reboot).
/var/log/journal/
Journal on disk (persistent).
/etc/systemd/journald.conf, /etc/systemd/journald.conf.d/
journald settings.

Exitcodes

0 :: Done. 1 :: Error (or no match with some options).

Volledige handleiding

Deze pagina legt het commando uit in eenvoudige woorden. De originele handleiding heeft elk detail.

In je terminal: man journalctl

Open de man-pagina (linux.die.net)www.freedesktop.org